diff --git a/CHANGELOG b/CHANGELOG
index 1a04e00..34a20aa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,12 @@
 We'll document all notable changes in this file, including bug fixes, enhancements, and dependency updates.
 Dates should be in`YYYY-MM-DD` format and versions are in [semantic versioning](http://semver.org/) format.
 
+## v0.10.7 2026-11-07
+
+### Fixed
+
+- People who aren't members of a public organization can now see its roles and who holds them.
+
 ## v0.10.6 2026-11-07
 
 ### Fixed
diff --git a/package-lock.json b/package-lock.json
index 758162f..c50f1c4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "adminima",
-	"version": "0.10.6",
+	"version": "0.10.7",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "adminima",
-			"version": "0.10.6",
+			"version": "0.10.7",
 			"dependencies": {
 				"@supabase/ssr": "^0",
 				"@sveltejs/adapter-vercel": "^7",
diff --git a/package.json b/package.json
index cb28860..5483e59 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "adminima",
-	"version": "0.10.6",
+	"version": "0.10.7",
 	"private": true,
 	"scripts": {
 		"dev": "vite dev",
diff --git a/src/lib/ARCI.svelte b/src/lib/ARCI.svelte
index 49e02a1..fef140c 100644
--- a/src/lib/ARCI.svelte
+++ b/src/lib/ARCI.svelte
@@ -20,9 +20,8 @@
 
 	const orgContext = getOrg();
 
-	// Mirrors the roles RLS policy: only members, or anyone if the org is public, can see its roles.
-	// Without them, every assignment would render as "Unknown role", so show nothing instead.
-	let canSeeRoles = $derived(orgContext().member || orgContext().org.visibility === 'public');
+	// Without the org's roles, every assignment would render as "Unknown role", so show nothing.
+	let canSeeRoles = $derived(orgContext().visible);
 
 	const dbContext = getDB();
 	const db = $derived(dbContext());
diff --git a/src/lib/Changes.svelte b/src/lib/Changes.svelte
index c3b802d..fa79f03 100644
--- a/src/lib/Changes.svelte
+++ b/src/lib/Changes.svelte
@@ -40,7 +40,6 @@
 	let { changes, profiles, children }: Props = $props();
 
 	const context = getOrg();
-	let org = $derived(context().org);
 
 	const dbContext = getDB();
 	const db = $derived(dbContext());
@@ -48,9 +47,9 @@
 	const user = getUser();
 	const Levels = { triage: 0, active: 1, blocked: 2, done: 4, backlog: 3, declined: 5 };
 
-	let visible = $derived(
-		($user === null && org.visibility === 'public') || ($user !== null && context().member)
-	);
+	let visible = $derived(context().visible);
+	// Only members can change a change's status; everyone else sees it read-only.
+	let canEditStatus = $derived($user !== null && context().member);
 
 	let filterText = $state(getInitialTextFilter());
 	let filterStatus = $state<undefined | StatusType>(getInitialStatusFilter());
@@ -214,7 +213,7 @@
 				{@const comment = latestComments.find((c) => c.id === change.comments.at(-1))}
 				<tr>
 					<td
-						>{#if visible}
+						>{#if canEditStatus}
 							<StatusChooser
 								tip="Change the status of this change"
 								value={change.status}
diff --git a/src/routes/org/[orgid]/+layout.svelte b/src/routes/org/[orgid]/+layout.svelte
index 12f3afb..1df45a2 100644
--- a/src/routes/org/[orgid]/+layout.svelte
+++ b/src/routes/org/[orgid]/+layout.svelte
@@ -4,6 +4,12 @@
 		org: OrganizationRow;
 		admin: boolean;
 		member: boolean;
+		/**
+		 * Whether the viewer can see the whole organization, not just its public items: its roles,
+		 * who holds them, and all of its processes and changes. Mirrors the SELECT policies on
+		 * roles, assignments and processes: members, or anyone if the organization is public.
+		 */
+		visible: boolean;
 		counts: {
 			roles: number;
 			profiles: number;
@@ -42,6 +48,7 @@
 		org: data.org,
 		admin: data.admin,
 		member: data.member,
+		visible: data.member || data.org.visibility === 'public',
 		counts: data.counts,
 		shortRoles: data.shortRoles,
 		shortProcesses: data.shortProcesses
diff --git a/src/routes/org/[orgid]/process/[processid]/+page.svelte b/src/routes/org/[orgid]/process/[processid]/+page.svelte
index 7e1d464..657a0db 100644
--- a/src/routes/org/[orgid]/process/[processid]/+page.svelte
+++ b/src/routes/org/[orgid]/process/[processid]/+page.svelte
@@ -68,8 +68,7 @@
 	// This mirrors the row-level security policy: only admins and people with an accountable or responsible role can edit this policy.
 	let isAdmin = $derived(orgContext().admin);
 	let isMember = $derived(orgContext().member);
-	// Mirrors the roles RLS policy; without roles, assignments would all render as "Unknown role".
-	let canSeeRoles = $derived(isMember || orgContext().org.visibility === 'public');
+	let canSeeRoles = $derived(orgContext().visible);
 	let accountable = $derived(
 		$user !== null &&
 			process !== null &&
diff --git a/src/routes/org/[orgid]/processes/+page.svelte b/src/routes/org/[orgid]/processes/+page.svelte
index c59e65a..b6c69eb 100644
--- a/src/routes/org/[orgid]/processes/+page.svelte
+++ b/src/routes/org/[orgid]/processes/+page.svelte
@@ -59,9 +59,7 @@
 
 	let isAdmin = $derived($user && orgContext().admin);
 
-	let visible = $derived(
-		($user === null && org.visibility === 'public') || ($user !== null && orgContext().member)
-	);
+	let visible = $derived(orgContext().visible);
 
 	let filter = $state(getInitialTextFilter());
 	let lowerFilter = $derived(filter.toLocaleLowerCase().trim());
diff --git a/src/routes/org/[orgid]/role/[roleid]/+page.svelte b/src/routes/org/[orgid]/role/[roleid]/+page.svelte
index d3c6dde..2bc32d1 100644
--- a/src/routes/org/[orgid]/role/[roleid]/+page.svelte
+++ b/src/routes/org/[orgid]/role/[roleid]/+page.svelte
@@ -40,9 +40,7 @@
 	let profiles = $derived(Organization.getRoleProfiles(role.id, assignments, allProfiles));
 	let isAdmin = $derived($user && orgContext().admin);
 
-	let visible = $derived(
-		($user === null && org.visibility === 'public') || ($user !== null && orgContext().member)
-	);
+	let visible = $derived(orgContext().visible);
 </script>
 
 <Title
diff --git a/src/routes/org/[orgid]/roles/+page.svelte b/src/routes/org/[orgid]/roles/+page.svelte
index 7990f63..10945f0 100644
--- a/src/routes/org/[orgid]/roles/+page.svelte
+++ b/src/routes/org/[orgid]/roles/+page.svelte
@@ -2,7 +2,7 @@
 	import { goto } from '$app/navigation';
 	import RoleLink from '#lib/RoleLink.svelte';
 	import Field from '#lib/Field.svelte';
-	import { getDB, getUser } from '#routes/+layout.svelte';
+	import { getDB } from '#routes/+layout.svelte';
 	import { getOrg } from '#routes/org/[orgid]/+layout.svelte';
 	import { mutate } from '#routes/errors.svelte.ts';
 	import Title from '#lib/Title.svelte';
@@ -29,17 +29,12 @@
 	const dbContext = getDB();
 	const db = $derived(dbContext());
 
-	const user = getUser();
-
 	let newRole: string = $state('');
 	let filter: string = $state('');
 	let lowerFilter = $derived(filter.toLocaleLowerCase().trim());
 	let path = $derived(Organization.getPath(org));
 
-	/** Roles are visible if the org is public or the authenticated user is in the org. */
-	let visible = $derived(
-		($user === null && org.visibility === 'public') || ($user !== null && orgContext().member)
-	);
+	let visible = $derived(orgContext().visible);
 
 	async function createRole() {
 		const { data } = await mutate(